Going beyond the idiomatic Python - <AUTHOR> https://hackernoon.com/going-beyond-the-idiomatic-python-a321b6c6a5e6 <comment><USER2> > People don't speak entirely in idioms unless they are totally off their > rockers.

My first thought on reading that was to think of Darmok and Jalad at Tanagra. Then I realized that was allegory, not idiom. Then I realized I had no idea what the actual definition of "idiom" is, and looked it up: "a group of words established by usage as having a meaning not deducible from those of the individual words (e.g., rain cats and dogs, see the light)."

...and now I'm confused because nearly everything we call an idiom in programming isn't. What would be the correct term for whatever it is we are currently calling programming idioms?

For example, one from the idiomatic Python book that the article criticizes:

      def contains_zero(iterable):
        # 0 is "Falsy," so this works
        return not all(iterable)

That one was confusing to me, because I'm not a heavy Python user. I've never encountered all() before. However, after looking up the all() function in the Python documentation that code becomes immediately obvious.

It seems that most of what we call idioms in programming are just using more advanced or more obscure language features or library functions to do something in a more compact or efficient way at the cost of immediate clarity to people who are not as advanced in the language. We've decided what these do is needed often enough that we agree that these are the way people should do these things, even if they don't understand what is actually going on.

I'm not sure programming languages can have actual idioms, except perhaps in the case of language bugs or bad/missing documentation.

The combination of language plus hardware could have idioms, like nested loops iterating a multidimensional array should have the outer loop on the first dimension, the second loop on the second dimension, and so on to minimize jumping around in memory and so hopefully interact better with the cache.

<comment><USER3> It's even worse; the book is wrong. That implementation of contains_zero is not idiomatic to anyone who writes Python.

<comment><USER4> Not only is it not idiomatic; it's functionally incorrect.

An iterable containing `[]`, `None`, or any other value that is false in a boolean context would return true. They've assumed that `(0 -> false) -> (false -> 0)`, which is simply not true.

Even if you're dealing with a context that cannot pass in an iterable with non-zero "falsy" values then it needs to be explicitly documented. At that point, why not "document" it by being explicit with the code. This is how I'd do it, but I feel like it could be made cleaner:

        def contains_zero(iterable):
            return any([i is 0 for i in iterable])

Edit: I forgot how to python. It's `return 0 in iterable`.

</comment></comment></comment><comment><USER5> The worst idiom of Python is the idea of Pythonic. It is usually prefixed with "un" and used pejoratively. The rest of the cases it is used to rationalize arbitrary biases such as Python's lack of an identity function and the removal of map and filter [1] from the core language.

There's no such thing as "very Pythonic." It's a binary and the worst aspect of Pythonic is that people waste so much energy trying _not_ to be unPythonic in order to meet the mores of the community.

[1]: Edit, Ok, I was confusing two experiences. It was reduce's removal that broke my code using the map->filter->reduce idiom. Map broke by returning a Map object rather than a list (but that was between Python and Python3). And so far as I know, filter has not been changed so as to break code.

<comment><USER6> > the removal of map and filter from the core language

This never happened-- perhaps you're thinking of reduce? And reduce is still in it, it just got moved to `functools`.

<comment><USER5> Thanks, I stand corrected. My high level memory is that the map->filter->reduce idiom was broken because <arbitrary>. Adding to my confusion was my conflating that <arbitary> with my memory of map breaking code by returning a map object rather than a list.

<comment><USER6> You're right in that map returned a list in python 2, but in python 3, it returns an iterator. Anyone who relied on indexing or non-lazy behavior would have their code break.

GVR doesn't like functional-style programming, so he much prefers the iterative but compact comprehension alternatives.

It may just be the circles I hang out in, but most folks aren't map/filter versus comprehension purists. I'll do comprehensions usually, but map/filter when it helps make the line shorter or more readable.

<comment><USER5> I don't have anything against list comprehensions. Sometimes they are a very useful abstraction. Other times map->filter->reduce better expresses the business logic of the program (e.g. when the analog is signal processing [1] or Unix pipes).

My issue with 'Pythonic' is that it is used to express the idea that someone's thoughts are or are not properly structured.

[1]: [https://mitpress.mit.edu/sicp/full- text/sicp/book/node35.htm...](https://mitpress.mit.edu/sicp/full- text/sicp/book/node35.html)

</comment></comment></comment></comment></comment><comment><USER7> Some of the examples in the book violate the Zen of Python. So I wouldn't even call them pythonic or idiomatic in the first place.

E.g.:

`contains_zero` violates "There should be one-- and preferably only one --obvious way to do it."

`should_raise_shields` violate "Explicit is better than implicit."

`linsolve` and `contains_duplicate` violate "Readability counts."

<comment><USER8> I was thinking exactly this as I was going through those examples.

</comment></comment><comment><USER9>
        def inverse_of(matrix):
            return adjugate_of(matrix) / determinant_of(matrix)

aiiieeee no, don't do that

<comment><USER10> Why? Don't like self-documenting code?

<comment><USER11> It's numerically unstable and O(n^3) (at least, probably worse) when computing via row reduction is O(n^2).

</comment></comment></comment><comment><USER12> I like the rules that lays out in this article. However, I don't see his argument against Writing Idiomatic Python. He cherry picked two methods that (correctly) could have been written better. However, this does not mean that all idioms are bad, and he doesn't provide any examples where using an idiom is sometimes bad and sometimes good.

Additionally, it seems like the word idiom is just re-skinned as a "rule" in this article.

<comment><USER13> He provides three examples where an idiom is sometimes bad and sometimes good...

The point of the article is just the classic 'foolish consistency is the hobgoblin...'

</comment></comment><comment><USER14> This is a little bit off topic, but one thing that I wish python used is ruby's indicators for the purpose of a function. i.e. "?" for boolean returns, and "!" for modifying functions in place.

In a language without explicit typing and return values having an instant indicator of the functionality of a function can be a huge help in writing readable code.

<comment> cup-of-tea Is this enforced in Ruby or just a convention? It's a great convention and is used in Clojure and older Lisps at least with the -p suffix (for predicate). There's no reason you can't use the same convention in Python. I've often wanted to write predicates with the -p suffix but stopped myself becasue I don't think other Python people would understand it. Maybe I should just do it anyway.

<comment><USER5> {being pedantic} In Python, you can't use the '-p' suffix because Python will treat it as subtraction.

{being unPythonic} If it makes you happy to use '_p', do it. Explain it in the documentation if it might cause confusion. Be flexible enough that you'll change before letting yourself be voted off the island because it's not that important.

{rabble rousing} I think there is room in the world for an alt-python movement...[https://github.com/altpython](https://github.com/altpython)

<comment> cup-of-tea Yes, you'd have to use just p. The convention in Lisp is it's just p unless the function name is multiple words anyway in which case the words are separated by hyphens and the suffix is -p.

I suppose it is more Pythonic to name predicates like "is_full" or something rather than "fullp". But whatever it is I've found I can't stand not using some kind of naming convention for predicates.

<comment><USER5> I think the problem is more that Python doesn't really have the idea of predicates as an abstraction. It's not that it doesn't have predicates, it's just that they are not called that and not seen as thing in their own right and not something that programmers are encouraged to write.

<comment> cup-of-tea Yeah, that's true. Maybe I'm being narrow minded and not "Pythonic" enough, but I always end up writing predicates. I can see that non-trivial predicate functions could be changed to non-trivial functions that return something which can later be compared to get the boolean. But what about having a list of of predicates and wanting to test them all at once. all(p(x) for p in predicates) seems perfect for this...

</comment></comment></comment></comment></comment></comment><comment><USER15> If you're aiming for idiomatic on 6 you don't do:

        def contains_duplicate(array):
            return sum([sum([1 if a_i-rot_ij else 0
                        for a_i, rot_ij in zip(array, rot_i)])
                        for rot_i in [array[i:] + array[:i]
                        for i in range(1, len(array))]]
                       ) != len(array) * (len(array) - 1)

OR:

        def contains_duplicate(array):
            for i in range(len(array)):
                for j in range(i):
                    if array[i] == array[j]:
                        return True
            return False

You do:

        def contains_duplicate(array)
            return len(set(array)) < len(array)

Or, if you can't hash the items:

        def contains_duplicate(array):
            any(len([y for y in items if x == y]) > 1 for x in items)

FWIW, I don't think I've ever seen an example where the cleanest (list | generator) comprehension is less clear than the cleanest equivalent for loop. I don't believe one exists.

So I think the examples are contrived and the 'rule' is bullshit.

<comment><USER16> > FWIW, I don't think I've ever seen an example where the cleanest (list | > generator) comprehension is less clear than the cleanest equivalent for > loop. I don't believe one exists.

Interesting. I'm not sure if I agree or disagree.

I think the primary benefit of a comprehension is that it can be considered as a "unit", and you don't have to think about the iteration as fully to understand what's happening. As soon as "what's happening" gets more than minimally complex, that advantage is lost. Generator comprehensions should be much more clear and concise than their equivalent implementations using generator functions, though.

If I remember this evening, I'm going to go through my code library and see if I can find something that will satisfy your challenge :)

<comment><USER15> I consider it an instance of [https://en.wikipedia.org/wiki/Rule_of_least_power](https://en.wikipedia.org/wiki/Rule_of_least_power)

List comprehensions are less expressive than for loops hence there is less to reason about.

Hence, if what you want is achievable with a list comprehension, its intent will naturally be clearer than the for loop equivalent.

...provided you don't make it intentionally obtuse like the OP did.

</comment></comment></comment><comment><USER17> Obviously, any falsey value triggers the "idiomatic" contains_zero function:

        [1, False, 3]
        [1, '', 3]
        [1, None, 3]
        [1, [], 3]

This seems like it could only make bugs harder to track down, yet this is often touted as the Pythonic way. What's the benefit of this approach?

<comment><USER3> The original implementation of `contains_zero` in the blog post is not idiomatic. (It's also incorrect, as you point out.)

The idiomatic implementation of `contains_zero` is the second one given, `0 in container`.

Just because someone claims something is idiomatic in a book doesn't mean they are correct about it being idiomatic.

<comment><USER17> You're right. PEP8 says:

> _beware of writing if x when you really mean if x is not None -- e.g. when > testing whether a variable or argument that defaults to None was set to some > other value. The other value might have a type (such as a container) that > could be false in a boolean context!_

This should apply to the contains_zero function as well. It seems a little murky when PEP8 recommends checking whether a sequence type is empty,

        Yes: if not seq:
             if seq:

        No: if len(seq):
            if not len(seq):

if seq were accidentally set to False or 0. But I guess that would be revealed as soon as you start treating seq like a sequence.

</comment></comment></comment><comment><USER18> I'd argue that actually all of the suggestions in this post are more idiomatically pythonic than the original ones. So the trick is not to avoid idioms but just to write clearer code :)

<comment><USER19> it's also a quality that takes times, you have to weight a lot of things together. shorter names sometimes, longer names sometimes... Something you appreciate with times, no matter the language.

</comment></comment><comment><USER20> Let me unleash a monster that I created:

[https://stackoverflow.com/a/44729275](https://stackoverflow.com/a/44729275)

<comment><USER21> It seems unnecessary:

        LET(('a', 1,
               'b', 2),
              lambda o: [o.a, o.b])

alternative:

        lambda a=1, b=2: [a, b]

Thing _do_ get worse when you need dependencies:

        LET(('a', 1,
               'b', lambda o: o.a + 1),
              lambda o: o.b)

alternative:

        (lambda a=1: lambda b=a+1: b)()

<comment><USER20> I would argue my version scales more gracefully.

How would you write this, for example?

        LET(('a', 2,
             'b', lambda o: o.a + 1),
             'c', lambda o: [i * i for i in range(o.b)]),
            lambda o: o.c)

        => [0 1 4]

</comment></comment></comment><comment><USER22> While I adore Python generally and use it all the time (including for two startups), here are a few things that I find unintuitive:

1\. List comprehensions are hard to read and understand, especially for beginners. I tutor online in Python, and when I show a student a list comprehension, it is one of the most difficult parts of the language to explain. Do you read left to right, or inside to outside? Postfix if at the end makes things even more confusing.

There are better alternatives in languages like Ruby and JavaScript. Which brings us to the next point:

2\. No native map, filter, reduce, etc. methods. It is far easier to explain that you are just calling another method on a list/array than it is to get a beginner to trust the hocus-pocus apparent in Python's list comprehensions.

Edit: Python has built-in functions for map and filter. See correction by ubercore below, and my response.

3\. The way a class is accessed from an instance in Python is not nearly as elegant as Ruby's. Do I use "type(obj)" or make a direct call with "obj.__class__"? Neither is as clean or intuitive as "obj.class".

4\. Speaking of classes, why are built-in classes like "str", "int", "float", etc. lowercase while in everything else they are conventionally CapitalizedClasses?

5\. Remembering that "sorted(my-list)" returns a new sorted list while "my- list.sort()" does the sort in-place requires experience, which someone taking an Intro to Programming course will probably not accumulate over 8 or even 14 weeks.

Note: I flirted with Ruby and Rails, but never built anything real with them. I vastly prefer Python to Ruby (and Django to Rails), but think Ruby got a lot of things right.

<comment><USER23> No native map or filter? Unless I don't understand what you mean by native, don't [https://docs.python.org/3/library/functions.html#map](https://docs.python.org/3/library/functions.html#map) and [https://docs.python.org/3/library/functions.html#filter](https://docs.python.org/3/library/functions.html#filter) and [https://docs.python.org/3/library/functools.html#functools.r...](https://docs.python.org/3/library/functools.html#functools.reduce) count?

<comment><USER22> Thank you for correcting me. I edited my post above to reflect that.

But having to provide a lambda for the simple case makes them less useful. Also, nested function calls are less readable than chaining method calls on the same object.

</comment></comment></comment><comment><USER24> _Rule 6. Just because you can do anything with list comprehensions, doesn't mean you should_

I have been very guilty of this one, it's a running joke at work gatherings. In the flow I can quickly spit out comprehensions that are obtuse to everyone else. My general rule of thumb is that if I ever have to troubleshoot it I break it out into a for loop

</comment><comment><USER25> The Zing of Python

(Or the well intentioned but ultimately misguided attempt to enlighten the masses.)

Pretty is better than boring.

Comprehensions are better than loops.

Short is better than long.

Clever is better than tangled.

Nested is better with line breaks.

Compact is better than meandering.

Appearances matter.

The point of a Python program is to teach people to write better Python programs.

Though if they're Java programmers just try to make them jealous.

Exceptions should never be explicitly checked.

Except StopIteration.

If you don't know how to make it Pythonic, refuse to take the obvious approach.

There should be one-- and preferably only one --Pythonic way to do it.

Although that way may not be obvious at first unless you're Dutch.

Now is better than never.

But it's fine to take ramp it up over time as long as you get there.

If it doesn't make a good blog post, perhaps it doesn't make good code.

If it doesn't make good code, it definitely doesn't make a good blog post.

List comprehensions are one honking great idea -- let's do more of those!

</comment><comment><USER26> To use a math analogy, I think of idioms as solutions to generalized coding problems. If you recognize your situation as a special case of the general form you can save yourself some time thinking through the implementation and make it easier to understand. Great. But also like math, you can get yourself into trouble trying to frame something in terms of a general case that doesn't actually fit, suddenly the plumbing is more complex than the original problem. The same thing plays itself out at a higher level with design patterns. The (obvious) point is not to force a solution into an abstract pattern at the expense of clarity, because that's the reason we like abstract patterns in the first place.

</comment><comment><USER27> On a tangent. I'm still kind of pissed off at Jeff Knupp. I bought the e-book which claims it is updated frequently and you get free updates for life. I have emailed him over three times asking about updates and so far have received zero replies :(

</comment><comment><USER28>
        To learn to write good code you have to write a shit-metric-ton of bad code.

The problem with this is how do you know if your code is good or bad? A lot of programmers never learn. They only way is to learn from others and write. You won't necessarily will be a better programmer if you just write programs by yourself.

</comment><comment><USER29> I teach Python to beginners, some of whom have had a CS class (e.g. in Java). I try to avoid idioms early on, such as list comprehensions and context managers, and slowly introduce them after students are confident with loops and such. It does feel painful and backwards, though, which is ironic for me to feel when I consider how confused/annoyed I was with Python initally when coming from Ruby.

</comment><comment><USER30> Agree with the critique but it's not quite fair. The original book is about Python, maybe sometimes misguided. The critique could be leveled at any language, it basically says: "be an experienced programmer with good taste."

</comment><comment><USER28>
        def are_all_numbers(everything):
            return all(is_float(e) for e in everything)</comment>


Introducing YouTube HTML5 Supported Videos - <AUTHOR> http://youtube-global.blogspot.com/2010/01/introducing-youtube-html5-supported.html <comment><USER2> _Our support for HTML5 is an early experiment, and there are some limitations. HTML5 on YouTube doesn't support videos with ads, captions, or annotations [...]_

I think I speak for everyone when I say: YouTube... do not fix these bugs!!!

<comment><USER3> From <http://www.youtube.com/html5>:

      # Videos with ads are not supported (they will play in the Flash player)
      # Fullscreen is not supported

So, no they should fix these bugs.

</comment></comment><comment><USER4> It's a shame they're not offering ogg theora (thus excluding firefox) but a step in the right direction nonetheless!

<comment><USER5> The shame is on Mozilla being so bullheaded and not implementing h264 and other parts MPEG4 _standard_.

(and this has been discussed over and over...)

<comment><USER4> I wouldn't agree. The choice between a patent-encumbered h264 or an improving open standard?

If you read this part: <http://www.diveintohtml5.org/video.html#licensing> it becomes clear that h264 isn't really a viable option for an open web. _You will have to start paying licensing fees by 2011 if you use the h264 codec_. Now I'm not against paying for good things, but paying $2500+ per year per video doesn't sound too attractive...

<comment><USER5> The point is that there is no need to make a choice between h264 and Theora. Firefox could easily support both (and a variety of other formats) if MozCo would allow it. I'm not against endorsing Theora, but it shouldn't break interoperability/compatibility and degrade overall user experience.

<comment><USER6> By not supporting h264 it helps prevent that codec from becoming the standard. If Firefox were to support ogg/h264 and everyone else supported only h264 then no one would bother with the ogg support. The format war would be lost at that point.

<comment><USER7> What "format war"? Everyone already standardized on h264 years ago, and there is a built in h264 decoder on damn near everything these days.

Keeping two copies of every movie would be a waste of CPU cycles, disk space and bandwidth (Theora videos are bigger than their h264 equivalents). Dropping support for h264 in favor of Ogg is also not an option due to h264 being in everything.

</comment></comment></comment></comment></comment></comment><comment><USER8> Could h264 support be added to Firefox with a plugin? Windows and Mac OS have the ability to natively play h264 videos, perhaps there is a way for FF to hook into that and not have to worry about any h264 licensing fees.

<comment><AUTHOR> No, they belligerently designed their <video> and <audio> implementations to make that incredibly difficult to do without forking the whole project.

They link directly with liboggplay instead of using a library like ffmpeg (Chrome), gstreamer (Opera), Quicktime (Safari), or DirectShow (IE, eventually). They don't even support any other container formats! _I hope their heads fall off._

</comment></comment><comment><USER9> ClickToFlash just became obsolete for Youtube for me.

</comment><comment><USER3> I wonder what Adobe will have to say about this. As a Firefox user, I am out of luck with no h264 support. It's interesting that the only two browsers that don't support Theora are Safari and IE, which makes the choice of h264 as the standard a bit odd to me.

<comment><USER10> I'm expecting a post from their paid Flash commenter (I'm sorely tempted to say professional troll, given some of his recent posts) jon dowdell saying something mocking about Ogg, then adding that HTML 5 is purely for minority browsers, and Adobe is fully focused on helping businesses and advertisers connect rich internet content with their customers in innovative and engaging ways.

(Translation: Flash will always rule, we're betting the company against Apple- Google-Mozilla, and the rest of the internet may hate us, but it won't matter because IE and Windows will dominate forever)

Meanwhile, those of us using "minority" browsers and Macs will do to Flash exactly what we did to Real.

<comment><USER11> Not classy, but then, that's what pseudonyms are for.... ;-)

(I was sort of relieved to see YouTube take the beta off... brings the conversation down from the clouds and into reality.)

</comment></comment></comment><comment><USER12> Can captions be supported with HTML5 videos? I could live without annotations, but I wouldn't want to lose captions.

Bill, I see deaf people.

<comment><USER13> You can implement that with regular HTML/Canvas/SVG on-top of the video. That's the beauty of the whole thing. I do wonder if full-screen will be supported someday.

</comment></comment><comment><USER14> Is it just me, or are the YouTube html5 videos of degraded quality on the Linux Chrome beta?

<comment><USER15> The player doesn't let you change video size/quality, so you might be seeing the lower res versions.

</comment></comment><comment><USER16> Is there a way to add additional video support into Firefox through an addon?

<comment><USER17> Short answer, no.

This is an evil plot or noble attempt (delete as appropriate) by Mozilla to promote royalty free audio and video standards on the web over popular standards with patent fees.

<comment><USER18> Are we really, really sure that no one is lurking with a patent?

<comment><USER16> That's why you make it possible to plug in any video codec you like, and isolate them from the Mozilla Foundation itself.

<comment><USER17> Mozilla Foundation isn't trying to protect itself, it's trying to protect the web.

You can disagree with that goal and/or with their strategy, but if you think it's just about Mozilla not wanting to pay fees then you're going to be very confused about what they do and why.</comment></comment></comment></comment></comment>


Not understanding users can kill a otherwise well run startup - <AUTHOR> https://email@example.com/the-right-way-to-fail-59e4b58cec55 <comment><USER2> Thanks for sharing this. It is really educative. I am sharing this with my students.</comment>


My story with a start-up (equity blues) - <AUTHOR>

Me: worked in mktg/biz dev for a number of successful European web start-ups.
I meet the founder of a very promising start-up. He tells me salary will be low. I say: great, I'm more interested in equity. Salary is low, but the path to equity is unclear (promised shares in the local company, but with no indication at all of how to judge the value of the local company respective to the total value of the mother company in case of a sale or IPO).
I make a counter-offer: I'll work and get only equity in the mother company. Each month for the first year, I'll get 1/12th (one twelfth) of what each business angel got for the 50,000 Euros they invested in the company just one month before, plus maybe a bonus of some kind. From year-2, only dividends on profits. His reply: no way, I can't treat you like an investor. I though one ought to be delighted to have a country manager who belives in your company so much and wants only equity. I drop out of negotiations.
What do you think? <comment><USER3> I don't understand the local company/mother company distinction. A startup doesn't normally have a child company or a mother company. Is this really a spinoff? And there are outside investors? Sounds pretty strange. However, I can see how in a situation like this the mother company might not go for you being an investor, (maybe it isn't the founder). Is the mother company itself large and profitable? If they aren't, why are they spinning off? If they are, why are there outside investors and no salaries?

Profits in year 2? Are you pretty sure there will be any?

This whole thing sounds flaky so far.

<comment><AUTHOR> Mother company: a UK Ltd company. Business angels invested in this company. Business started less than a year ago and at present almost certainly earning profits every month in one EU country (not the UK) where they already have a local company, which is 100% owned by the UK Ltd. Planning to open a number (let's say up to 4) of other local companies in other EU markets. I would have had shares (say 10%) in one of these local companies. Pretty sure there would have been profits in year-2. Thanks and I hope this clarifies things a bit.

</comment></comment><comment><USER4> Sounds like you dodged a bullet. If you're being paid below your market value, you're an investor.

<comment><AUTHOR> Was offered 30% of what I think the position was worth in cash.

</comment></comment><comment><USER5> The founder is correct, an employee is not an investor.

Furthermore, a 12 month vesting period is far too short, immediate vesting is also a poor practice, and a startup should not be paying dividends or distributing profits in year two - it should be using that money for growth.

In my opinion, your counter-offer appears to be geared for a quick acquisition of equity and then walking away. And that's not the kind of person a founder should provide with equity.

<comment><AUTHOR> A country manager, in this case, so a person in a position of a certain importance, not just a normal employee.

12 months is too short a period? Possibly. But I received no counter-proposal. And, frankly, I was expecting one.

<comment><USER5> IMO, your proposal suggested characteristics which might be troublesome within the group of stockholders of a tightly held company.

Among these are a lack of long term commitment due to the rapid vesting schedule and a questionable ability to accept the responsibilities of an employee rather than that of investor.

That's not to say that the owners of the company are beyond reproach - <USER2> offer of a low salary combined with stock in an enterprise of dubious purpose certainly raises suspicions.

However, your description of the state of affairs does not make their decision to pursue your services without great zeal unsurprising.

</comment></comment></comment><comment><USER6> Sounds too complicated and non-typical for the founders, probably told their investors about the offer and got advice that you were more trouble than you were worth.

<comment><AUTHOR> ok for the non typical. Didn't like the "more trouble than you were worth" part, but thanks for the feedback nonetheless.

</comment></comment><comment><USER7> Investors are not just a source of money, they are also entry points into their networks and an access to enterprenueral advice and insight. There are plenty of people how can spare 50k, but some are far more valuable than others.

<comment><AUTHOR> I understand this, of course. But I could have been an important - I think - entry point into an important market for them.

</comment></comment><comment><USER8> The right move. If you are an employee don't budge on salary one dollar. If you want to work at a startup, just find some people and become a founder with your equity share written right into to the agreement.</comment>


Snapdragon chip flaws put 1B Android phones at risk of data theft - <AUTHOR> https://arstechnica.com/information-technology/2020/08/snapdragon-chip-flaws-put-1-billion-android-phones-at-risk-of-data-theft/ <comment><USER2> I have never had an iOS device in my life, but these three paragraphs provide probably the most convincing reason to finally make the switch:

> A billion or more Android devices are vulnerable to hacks that can turn them > into spying tools by exploiting more than 400 vulnerabilities in Qualcomm's > Snapdragon chip, researchers reported this week.

> The vulnerabilities can be exploited when a target downloads a video or > other content that's rendered by the chip. Targets can also be attacked by > installing malicious apps that require no permissions at all.

> From there, attackers can monitor locations and listen to nearby audio in > real time and exfiltrate photos and videos. Exploits also make it possible > to render the phone completely unresponsive. Infections can be hidden from > the operating system in a way that makes disinfecting difficult.

<comment><USER3> I like Apples devices, but aren't they just as vulnerable to CPU bugs?

There's plenty of good reasons to use an iOS device (and some good reasons to avoid one), but I wouldn't think that CPU bug would be a particularly strong reason on either side.

<comment><USER4> Bugs can be discovered anywhere. The question is whether those bugs will be patched.

The original iPhone SE is about to start it's sixth year of OS updates and security patches.

Which works out to less than $70 per supported year.

That's a legitimate advantage over the Android ecosystem.

<comment><USER5> and literally any 10 year old android phone can run not just the latest security patches but even the latest android. you are taking the iphone limitation of 'os must be from hardware manufacturer' and for some reason applying it to android phones.

my 10 year old motorola nexus is running android 10 -which is the current version. you install the new os on android by downloading an app, which installs the new os on reboot. it takes 15 minutes, and gramma can do it.

next you'll tell me mac laptops are better because you can't put windows 10 on your old hp laptop, because hp's system image for it only goes to windows 7.

<comment><USER6> Sure, installing the updates may be simple, but getting the OS installed in the first place is not quite as simple.

Also, many Android devices don't even have unlockable bootloaders. This makes your first statement patently false. There is no way for me to install any updates to my abandoned Acer tablet as the bootloader is locked and the device is abandoned.

It may be true to say "many Android devices can be updated through community projects" but you're glossing over a lot of complexity.

I

<comment><USER7> I rarely root devices but I have yet to own an Android device that couldn't (eventually) be rooted using a community tool. This is anecdotal, there must be exceptions, but in my experience "locked bootloader" just means it might be a while before someone finds an exploit.

Easy enough for grandma, maybe not so much.

<comment><USER8> > Easy enough for grandma, maybe not so much.

This is pretty important when we're taking about a billion devices. The amount of people who do this is irrelevant and thus 99% or more of these users will be vulnerable until their phone stops working or the Facebook app no longer supports such an old version, forcing them to get a new one [assuming new Snapdragon chips fix the issue].

<comment><USER7> Right I never suggested otherwise, just clearing up the misconception that a locked bootloader automatically means the phone's OS can't be updated.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Ah, so it's actually pretty simple to avoid this vulnerability: all I need to do is upgrade to an Android phone based on one of the several competitive Snapdragon alternatives that are bound to be widely available given the staggering size of the market.

Hold on, I'm sure I'll find one any minute now...

<comment><USER10> What about samsung exynos and mediatek?

<comment><USER11> The new Samsung Galaxy Note 20 Ultra ships with Exynos in the UK and EU but performance drops against the same phone running Snapdragon (shipped in the US).

So whilst the security might be better, we're (tech geeks in EU/UK) don't want to pay the same price for a less performant phone sadly :/

But maybe in a few iterations!

<comment><USER12> I'm wondering why do people need the "performant phone". All the Android phones that I've had or seen in the last few years run the OS and apps with no issues. The amount of RAM might limit the multi-tasking, but otherwise I can't imagine a real-life use-case where I may want a "performant phone".

Can you maybe shed some light on this for me, please?

<comment><USER13> It starts to matter a lot with things like AR, video games etc. I work on an AR mobile product and the performance advantage for iOS is substantial. Outside of flagships, the performance of AR on android is pretty bad, while as far back as iPhone 8 you're maintaining 60fps no problems. I haven't tested older than that but I tend to believe the oft-quoted 5 year performance lead on the A series chips.

<comment><USER14> Nobody gives a crap about phone AR. And of those who play games the vast majority play games that don't need performance.

</comment></comment></comment></comment></comment></comment><comment> awinter-py Checkpoint's release for these vulnerabilities is here [https://blog.checkpoint.com/2020/08/06/achilles-small- chip-b...](https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big- peril/)

not clear from the writeup how many devices are affected. They fuzz-tested 'a DSP chip' (sounds like just one) and then say that Qualcomm products are used in 40% of devices.

press release focuses on exfiltrating media + GPS, not clear if this is a rootkit that can access the keyboard or take over your email.

'more than 400 vulnerable pieces of code were found' not clear to me -- maybe I don't know how fuzzing DSPs work? Do they have access to the source code because the image decoder is open source?

<comment><USER15> The qemu linux userspace implementation for hexagon is recently available and open source, yes. Not sure whether it would've been any harder to do fuzzing with the closed-source simulator that's been available for a long time. But the fuzzer doesn't need the libraries' source, it just makes it easier for the fuzzer if it has access to the source. And the availability of emulator or simulator code is probably independent of this too.

The 400 distinct bugs are the uniquely faulting instructions or paths uncovered by the fuzzer.

</comment></comment><comment><USER16> Blog spam. Typical ArsTechnica these days.

Here's the actual report: [https://blog.checkpoint.com/2020/08/06/achilles- small-chip-b...](https://blog.checkpoint.com/2020/08/06/achilles-small-chip- big-peril/)

<comment><USER17> Honestly this "report" is similarly devoid of any substantive content despite being the original source. At some point they discuss the dictionary meaning of DSP.

Your best bet for any details is apparently this DEF CON presentation:

[https://www.youtube.com/watch?v=CrLJ29quZY8](https://www.youtube.com/watch?v=CrLJ29quZY8)

</comment></comment><comment><USER18> DEF CON talk given by Check Point a few days ago: [https://www.youtube.com/watch?v=CrLJ29quZY8](https://www.youtube.com/watch?v=CrLJ29quZY8)

</comment><comment><USER19> The article is pretty spartan in details regarding the vulnerability but as I understand it, the DSP is the attack vector.

Wouldn't it make sense for Qualcomm to hardware/software sandbox the memory content being processed by each part of the SoC?

Would such an attack also work on PCs with iGPUs, since they share the system memory?

<comment><USER20> Yes - that's what iOS devices and modern computers do. The risks of allowing unrestricted DMA started to get publicized in the mid-2000s when FireWire was used to attack locked Macs. IOMMUs are pretty common now but the OS still has to enable them.

<comment><USER21> IOMMUs aren't the only way to get secure DMA, it's more common for small devices to have a double-ended device where the other end (OS vs. DSP in this case) needs to set up its own pointers itself. Doing it via page mapping is very heavyweight and used for performance reasons when you need both safety AND fast random access to large regions.

<comment><USER20> Yes - my main reaction was just that it was something of a surprise to see Qualcomm not using any of the common countermeasures for a class of attack which is not new and for which they've had problems in the past.

</comment></comment></comment></comment><comment><USER22> Yikes.

Could Google theoretically remotely disable/remove apps that they identify using the DSP in malicious ways?

<comment><USER23> If it's in the DSP it may not need to be an app that runs the exploit. Sounds like any malicious audio or video file could do it. Could be something delivered via a streaming site, email, audio embedded in a webpage, etc. This sounds like it could be a very big deal.

It's great that Qualcomm has a fix, but most of the susceptible devices will likely never get it in an update from their manufacturers. And I wonder if there will be a performance or battery life hit like the awful performance hit in the Intel chips. That one cost me a 30% hit on my servers and resulted in 6 figures of unplanned spending to replace that lost capacity.

<comment><USER22> > If it's in the DSP it may not need to be an app that runs the exploit. > Sounds like any malicious audio or video file could do it. Could be > something delivered via a streaming site, email, audio embedded in a > webpage, etc. This sounds like it could be a very big deal.

Seems unlikely to me. DSP data vs DSP code - I think it's in the latter that you'll find vulnerabilities.

<comment><USER24> Second paragraph in the article: malicious media (i.e. video) can exploit it

</comment></comment></comment></comment><comment><USER25> Half amused, I wonder if the odd recommendations we get on YouTube from time to time are actually steganographs meant to distribute surveillance malware that leveragea this technique.

</comment><comment><USER26> Uhm wasn't this already the case in augustus 2019?

</comment><comment><USER27> Yet another reason why the protectionist hit job on Huawei was a bad idea. My Mate 30 Pro will not be affected by this flaw.

<comment><USER28> > My Mate 30 Pro will not be affected by this flaw

It will just keep being affected by being a bad phone.</comment></comment>


Ask HN: What, if anything, will come after Facebook for human connection? - <AUTHOR> Based on all these headlines, people seem to be 'catching on' or 'burning out' of Facebook. I have been for awhile but I've almost given up hope as to anything taking it on directly or challenging it's market position. At this point, it's like trying to supplant Windows.<p>What are your thoughts? I don't have much to say, I just want to read and reflect. <comment><USER2> I have a rule of thumb that i've developed over the years: anytime someone tells or asks about X's killer, its a sign X is firmly established in the market and will not go away anytime soon. When people actually start ignoring X in favor of Y, then it changes: people just stopped talking about Myspace and its flaws.

<comment><USER3> Now that's a delicious heuristic. Thank you!

</comment></comment><comment><USER4> My thought: just because social attitudes change and something develops a stigma doesn't mean that thing won't still be commercially successful for a long, long time. Television, fast food and sugary drinks, over-sized cars, telemarketing...

It might be that in 5 years, Facebook will be as popular in the Bay Area as McDonald's is. I'm not sure that in that scenario Facebook won't still be a strong business.

Don't get me wrong: I think we're due for a cultural backlash against the kind of "information sugar" Facebook embodies. But I'm skeptical about how much such a backlash would really accomplish.

Maybe you'll see some kind of "up-market" services emerge that cater to new tastes (in this case: greater value placed on limited distraction/sustained attention). What is the Whole Foods Market in this area?

</comment><comment><USER5> > What, if anything, will come after Facebook for human connection?

"If anything"? I can pretty much guarantee you that in 50 years (or 100, to stay on the safe side), nobody will be using Facebook anymore. The question is not "if" but "what".

Speculating on coming tech is risky, but my prediction is a two-way trend: graphic and text-based communication. Email is one of the oldest computer communication tools around (and basically a continuation of the millenia-old practice of writing letters) and doesn't seem to be going anywhere. Text-based communication is ideal for formulating complex ideas and offers low storage/delivery costs. I don't know whether we'll still be calling it email, but I'm pretty sure we'll still be writing some sort of letters in 2100. On the other hand, private conversation is a lot more enjoyable when it is face- to-face, giving the participants the opportunity to latch on to non-linguistic cues such as voice inflection or facial expressions. Thus I would imagine that some sort of telepresence communication platform is going to be pretty important in 2100 (akin to Skype et al. today, though perhaps with elements of virtual reality).

tl;dr Facebook as a company isn't going to stick around for ever, but letters and visual chatting are here to stay.

</comment><comment><USER6> facebook was great for helping human connection but obviously comes with it's limitations. apps like facebook/whatsapp clearly expand the breadth of who we can connect to and how often, but there's so much more to tap into when it comes to human connection that text/photos won't do. the fact that you mention "if anything" is almost a little depressing to me. surely technology will have a lot more to offer.

video chat is another connection mechanism that provides more depth in ways that text/photo sharing never will -e.g. it reaches more of our senses.

the next big thing will be something very different and the trick will be getting it into every home. imo, it's clearly virtual reality related. i should be able to put on a headset/glasses and and sit in my living room with a friend and have that beer while chatting with them so it feels like they're in the room with me. the more real this can feel the better.

i'd imagine google/facebook are already racing to find this next big thing today. getting this into every home is the key. this is a race worth investing a lot into imo. if someone else can beat one of these big companies to this, they'll find themselves in position to surpass them.

<comment><USER7> Why is it "clearly virtual reality related"?

<comment><USER6> i think that people are beginning to find these more shallow ways of connecting less meaningful and while they will always serve a purpose, i think that technology such as virtual reality will enable people who are not in the same room together to connect with one another in more meaningful and real (feeling) ways.

<comment><USER8> +1 for the VR "feeling transmitting Tech" thing.

however it might be a bit scary to use it in the long term I expect a short hype like with Chatroulette or SecondLife because everybody wants to try it at least one time but itl only stick with a few of those Initial Users and serve a real purpose there...

</comment></comment></comment></comment><comment><USER9> Facebook can be a force for good, if they remove people's currently trained over-dependence on watching their like/view/reshare counts.

These artificial numbers applied to all social interaction, fuck society up in all kinds of unexpected ways. These numbers are required to keep the advertising revenues flowing and can still be collected and supplied to them without causing social fabric damage.

The fallout and constructive handling of this mess is going to take a while to understand and get right. That said I think Facebook and YouTube and Twitter even though they are responsible for the mess, are also our best bets at figuring this stuff out.

These aren't tech problems. These are social problems requiring expertise from community builders, politicians, sociologists, ecologists, psychologist, lawyers, journalists, law enforcement etc

I think the evolution/next stage of the social network will be driven by such folk much more than the techie. The techie was required to create speed and scale. That job is complete. How we use the scale and speed, understanding it's positive and negative effect on society and utilizing it for the greater good is something tech companies will be hiring a lot of non-tech expertise to figure out.

I would like to see someone like Obama put in charge of Facebook to see what is possible.

</comment><comment><USER10> Facebook is a basic utility at this point. The products that attempt to "replace" it come in 4-6 year waves, reflective of the typical duration of high school or college. A new social app arrives, and if it breaks some initial barrier of discoverability (usually through growth hacks), it can enjoy some initial success on college or high school campuses. Users naturally arrive in four year cohorts. If the app has "staying power," the users will graduate and spread it to their new networks. Unfortunately this is not always the case.

Initial success for 4-6 years does not guarantee future success. Yik Yak is a great example of an app with initial traction that failed to capitalize. Much of that failure was attributable to product decisions. However, from the very beginning, they were tied to a rock in rising tides. Growth of YikYak benefitted from college culture, but the product itself became too dependent on that culture, limiting its ability to spread post-college. As a result, YikYak churned users as they graduated, and eventually there was nobody to replace them.

Snapchat appears to be the most recent company with "staying power." College campuses popularized Snapchat, but the product does not inherently depend on a college community like YikYak did. People continue using Snapchat after graduation.

When evaluating if a company will be the "next Facebook", you need to look at its "staying power." Can it break the 6 year threshold? Once that happens, it seems that public recognition and becoming a "household brand" is sufficient to sustain growth until at least the 10+ year mark (or lead to acquisition by FB [0]). For examples, see: facebook, twitter, instagram, whatsapp, youtube, twitch, reddit...

The next question is, what makes facebook different from all those other companies lasting 10+ years? How do you replicate that?

[0] Also, consider that we will never know how instagram or whatsapp would have developed, had they avoided acquisition by FB, like Snapchat did.

</comment><comment><USER11> I'd think Snapchat was kind of the next best thing, which is short videos that can be shared with friends. Most sources say that video is becoming "the thing". Although I'd still say that unique readable content will still dominate for the long haul, as it always has. I'm one to still prefer text over video.

</comment><comment><USER12> This topic is highly speculative, but my guess is something that's only possible via another technogical wave -- perhaps AIs that post interesting context of our lives on our behalf, or a new accessible medium better than text / photo.

</comment><comment><USER13> Does WhatsApp count, even though Facebook owns it? I use WhatsApp exclusively.</comment>


100 days of doing a startup - <AUTHOR> https://medium.com/@misbahspeaks/first-100-days-of-my-startup-980e9f463e3e

<comment><AUTHOR> Everyone has their own experience. I'd love to hear about them.

<comment><USER2> here is my story bro. [https://medium.com/@veermishra0803/90-days-at-a- startup-acce...](https://medium.com/@veermishra0803/90-days-at-a-startup- accelerator-5cd805459acd)

<comment><AUTHOR> Great write up. I can understand the pain of accelerators being in India. I feel like there is no serious need of accelerators for any startup. You just need a good mentor and a good investor for your startup who can give their costly time with you.</comment></comment></comment>


Understanding the prevalence of web traffic interception - <AUTHOR> https://blog.cloudflare.com/understanding-the-prevalence-of-web-traffic-interception/ <comment><USER2> "We found out that HTTPS interceptions are more prevalent than expected (4% - 10%) and pose serious security risks as they downgrade the encryption used to secure web communications."

MITM attacks on SSL through malware, anti-virus software and content-filtering / censorship appliances like Blue Coat.</comment>


The biggest company you've never heard of paying $25m to climate change deniers - <AUTHOR> http://www.greenpeace.org/usa/campaigns/global-warming-and-energy/polluterwatch/koch-industries-secretly-fund

<comment><USER2> Skeptic != Denier.

Using the word denier with its obvious connotations with Holocaust denial... classic fundamentalist lefty tactic.

</comment><comment><USER3> The circle of climate change deniers is truly strange and different. See, for example, <http://www.desmogblog.com/crescendo-climategate-cacophony> for an interesting study of who they are and who they represent.</comment>


Five Easy Pieces: Simple Python Non-Patterns - <AUTHOR> http://www.aleax.it/Python/5ep.html <comment><USER2> Picking on Singleton seems like a bit of a gimme. Isn't the current thinking that Singleton is an antipattern in almost all situations?</comment>


RIP coder.io - <AUTHOR> http://coder.io/ <comment><USER2> I must admit I didn't think this would be news. I only turned it off because (in the grand scheme of things) no one was using it. It would not be a huge deal to resurrect it but it just wasn't making any sense by the numbers so I turned it off to focus solely on my newsletter publishing business :-) (A bit like 37signals with Sortfolio, except coder.io wasn't making a penny ;-))

If enough existing users are bothered by the shutdown, I could look into re- enabling it in January.</comment>


Ask HN: Is the concept of a one-person software shop still viable? - <AUTHOR> I've started a software company and want to keep it just me and no employees. In this day and age with the popularity of SaaS and uptime needed is it still a realistic goal of starting and keep running a micro ISV? <comment><USER3> I'll add something I wish I had realized several years ago: build a SaaS is not the only path to a product business, and for a solo founder, it's (in my opinion) probably not a very good path.

I spent 5 years trying to get a micro ISV off the ground which made scheduling software for hair salons. It was a terrible idea for a large number of reasons (described in detail here: [https://www.jasonswett.net/im-shutting-down-snip- heres-why/](https://www.jasonswett.net/im-shutting-down-snip-heres-why/)) and I never made more than about $430/mo.

My opinion now is that info products are a better way for a solo founder to get started with a product business. The reason is that a SaaS product can take a huge amount of effort (perhaps pre-traction effort, which is risky) to get off the ground whereas an info product business can be started with a tiny "guide" and then expanded outwardly from there, keeping effort in proportion with traction the whole time.

My current business is AngularOnRails.com, an info product business. In its third month of making money, it made $1580, over 3 times what the SaaS made at its peak. Here's a detailed income report: [https://www.jasonswett.net/november-2016-angular-on-rails- in...](https://www.jasonswett.net/november-2016-angular-on-rails-income- report/)

<comment><USER4> Word. I started my current SaaS with the goal of working 10hrs a week and making 15k a month. I'm getting close to my monthly revenue goal but if I'm not sleeping, I'm working. I don't regret it. I'm enjoying the challenge now but it wasn't what I had thought I was getting myself into. I truly underestimated the gravity of emails and support requests. As a one man shop, it can grind entire days to a halt.

Passive info products do seem to be the easier path to a more leisurely success.

Edit: missed a word

<comment><USER5> That's pretty impressive actually! Have you considering hiring one or two people (e.g., freelancers) to remotely help with support? Also, a virtual secretary would be immensely helpful I'd imagine.

I have a couple of ideas I've been wanting to work on, but time is quite scarce as a grad student. I guess it's partly because I tend to overthink (and over-design) my ideas, and end up getting overwhelmed before even touching a line of code! What's even worse is that the majority of my ideas are intended for my home country (EST+6 timezone), since I think it's much harder to be successful in an over-saturated market like the US.

For example, one of my ideas is designing an Uber-like service for my home country. The current roadmap (which I haven't started on) is as follows:

1\. Design a basic placeholder site with some info on the app/service

2\. Run a limited ad campaign to gauge interest and ideally collect emails (Google, FB, local radio, local newspapers)

3\. Try to get interested users to fill out a survey

4\. If the results from 2) and 3) are promising, start developing a barebones MVP

5\. The MVP will target one city, require manual signup for drivers, and only have a simple web client

6\. If successful, start hiring local developers, optimizing server-side, and designing an Android app (iOS is a very small market)

Any advice for someone in my position? I'm open to all types of feedback from any HNer - it's always good to get an opinion before working on something like this!

<comment><USER6> I am not exactly qualified to gauge the viability of your idea but I believe an Uber-like service is pretty ambitious of a venture, especially given the fact that you'd go for it solo. Consider the fact that you need to fill both the demand-side and supply-side, and match them _almost in real time_ for it to be useful. I feel that it's often underestimated how challenging this task is.

I am not sure if a web-client would do the job. From my knowledge, interacting with maps on a mobile browser can be an aggravating experience. If an app doesn't do the job, isn't immediately useful, people discard it without further consideration which makes B2C things tenfold hard.

The surest way I see for it to work is to start as boring-taxi company that has a phone number and a person at the end. Then, slowly move into automated app-like way. I am guessing that's how OlaCabs, India's Uber, got started. Automation is awesome but there are so many points of failure in Uber-like venture that it's better to be safe by doing manual tasks.

<comment><USER5> Thanks for the feedback. I agree that it is in fact non-trivial to get automated ride sharing working end to end.

</comment></comment></comment></comment></comment><comment><USER7> Running solo doing around $750k/year on a desktop app. The market is so huge and so many niches to filll. Make something you can sell for $50-300 with upgrades once in a while and set up a simple shop. It has never been easier to develop desktop software. If I was going to start this route today I'd 100% make an electron app and try to address and already large market that has stagnated or has shitty entrenched players making a ton of margin.

<comment><USER8> How do you sell?

That's one of the annoying (and liberating) things about desktops, they don't have an app-store, so you have to run your own store (without reviews) and people have to trust that you're not going to sell them a virus.

<comment><USER7> Good SEO, reputation, big market, staying alive long enough that word of mouth starts to mean something.

</comment></comment></comment><comment><USER9> I built Jollyturns ([https://jollyturns.com](https://jollyturns.com)), a ski and snowboarding oriented business. I currently have a fairly extensive web site, and two mobile apps, on iOS and Android. I started with the iOS mobile app, I wanted something to show me on a ski resort's map where my friends are, and keep track of my skiing statistics.

I tried finding a partner to work with, but that's pretty much impossible in Silicon Valley where I live. Most good engineers want to work for one of the glamorous companies in the Valley. Oh well...

I've been working on Jollyturns for the past 5 years. It's been a lot of work, but I do it at my own pace since I still want to enjoy myself. The experience is unique. I write all the software myself, and hired few people to help map the ski resorts. I built a bunch of custom tools for the mapping work, so people can map the location of lifts, ski runs, restaurants inside a ski resort. I ended up having mapped all the ski resorts in the world, about 2700 of them.

Being by yourself, you need to be prepared to be a full-stack engineer. I built my own Supermicro servers, and host them in a colocation facility. I found that if you're in it for a long time it's cheaper this way. I run Kubernetes for cluster management, Postgres with PostGIS for database, Redis for caching, nginx for web proxy. Server side is written in a mixture of Python and C++. Web frontend is AngularJS (JavaScript). For iOS I write C, C++ and Objective-C. On Android I use Java.

Writing the code is the easy part. I found marketing to be the hardest. You need to find a way to make the world know what you built, and that's hard!

<comment><USER10> "Writing the code is the easy part. I found marketing to be the hardest" \- This part is the hardest, absolute hardest :-/

<comment><USER11> It also eats time like crazy and I find switching between development and marketing mindsets frustrating.

</comment></comment></comment><comment><USER12> I haven't done this, but if I was going to, I would target an existing platform that big companies depend on (salesforce, slack, more niche CRM's, etc.) and create a super focused niche plugin that 1) Is not core value prop of the platform, 2) Has little chance of being duplicated by the platform, 3) Has no competition, 4) Solves a real problem companies have.

For example, do research that shows that 7% of companies in industry XYZ use certain CRM. Analyze that industry and see what common use cases and pain points are. Somehow figure out what the CRM is missing for that industry. Validate the idea before building it by reaching out to said companies.

There would be a lot more to it, but basically a plugin for established software a company already uses is much easier and less risk to sell when you are a small shop.

<comment><USER13> I did exactly that ~10 years ago and made pretty good money with it at $50/install.

My plugin allowed you to put in your hotel when you traveled. Then it showed a list of your current & past customers' offices that were within X miles. Now you can fire off those "btw, I'll be in town in 2 weeks, we should talk about X" emails well in advance.

If I had to do it now, I'd tie into Tripit or Google Calendar to get the most accurate info, pull the data from your CRM, and send you an email with some "last contact" info & links to email them.

Oh.. and I'd make it a monthly charge instead of a one-time purchase.

<comment><USER12> Absolutely about the recurring revenue. Make it monthly or annual with a steep discount, but auto-renew. When I make mobile apps with advertisements, removing the ads is a yearly fee, not a one-time payment. Otherwise, they get lifetime benefits which does not accurately compensate me for my time, and I need to keep making new sales in perpetuity.

<comment><USER14> This sounds great, but it doesn't seem easy to pull off. Does it sit well with them and are they willing to pay for something like this? EDIT: wording

<comment><USER12> I would rather get die-hard users who would pay yearly, than constantly have to game the rankings to be high enough to get more sales. Even if the rankings change, you can get longterm value out of those who do pay, even if annual payments make less total customers.

</comment></comment></comment></comment></comment><comment><USER15> Uptime isn't the hardest part about running a solo SaaS shop -- you can solve it by a) bringing an appropriate amount of professionalism to engineering choices and b) choosing to found a business which has appropriate uptime constraints relative to your resources. Don't do analytics or infrastructure software where a 15s blip in your availability causes hundreds of pagers to go off. There exist many things businesses use which have markedly lower uptime than every SaaS a HNer will ship -- remember, businesses are built around most of their vendors having five twos. (That's a joke, but it isn't a joke.)

The harder part about running a solo SaaS company is building revenue takes _a very long time_, particularly if you're new at this. Most of my peers take ~18 months to hit the ~$10k revenue number that lets them durably transition to running the business as the full-time gig.

If you want to run a one-person shop which creates value substantially related to software, but you don't want to bite off the complexity of writing and selling a SaaS app for your first rodeo, I'd recommend a business model like productized consulting (the glide path to shipping a SaaS app!), selling infoproducts, or selling some sort of addon to an existing software ecosystem (WordPress, Shopify, etc).

</comment><comment><USER16> Totally viable. As a micro ISV you have practically no expenses so the only things you need are a mediocre product and handful of customers and you're already sustainable. Once you get to that point tons of options will present themselves.

Just build something that you know people need (meaning: there are other products in that space) that has a small enough scope so a single person can build it in a month or two. Then charge money for it.

The software market is ludicrously large, and because you don't have marginal costs in a software business you can afford to make a lot of mistakes on the business side of things and still make a profit.

You don't need a great product (plenty of lousy products sell well) and you don't need great business sense (many CEOs don't know what they're doing) and you don't need great marketing (same). For your business to work you have to clear the minimum bar in all three areas, but luckily the bar is set pretty low!

</comment><comment><USER17> For us peasants not trying to sell anything : [https://en.wikipedia.org/wiki/Micro_ISV](https://en.wikipedia.org/wiki/Micro_ISV)

<comment><USER18> Yep, had to Google this, as well.

</comment></comment><comment><USER19> Not the same thing exactly, but I'm able to run 2 ecommerce sites with non- trivial sales volumes, by myself.

The two biggest things that make this possible:

a) Email support only, no telephone support (sales or post sales). Not everyone likes it, of course, but if you're determined to be a one man band, it's essential.

b) Automation of every single thing you can. For you, it would be a different list, but I had to automate things like refunds, tracking numbers, inventory levels, fraud detection, etc.

Also consider having someone you trust have access to documentation, passwords, accounts, etc...in case of some kind of emergency, etc. If it's making money, it would be a shame not to be able to pass it on to a beneficiary if you were to die unexpectedly.

<comment><USER20> >Also consider having someone you trust have access to documentation, passwords, accounts, etc...in case of some kind of emergency, etc. If it's making money, it would be a shame not to be able to pass it on to a beneficiary if you were to die unexpectedly.

This is important. Redundancy and automation are your allies, but it is prudent to implement some sort of keyman insurance.

</comment></comment><comment><USER21> Yes its definitely viable. I started my micro ISV 6 years ago, its been quite successful about $200k/yr. Its very niche. I do no marketing but get regular sales through mainly word of mouth and internet searches. Now some bigger companies have picked up my software and use it in house and OEM it. Took a lot of work to get started and a lot of learning Its difficult for competitors to make something similar in a reasonable amount of time so its got a nice moat around it at the moment. I have no employees and almost no overheads so all revenue is profit. The most useful thing is when other companies build around your product, they provide valuable test / customer feedback which greatly reduces the work load.

<comment><AUTHOR> Do you mind sharing what space your product is in?

</comment></comment><comment><USER22> I am currently running as a single founder, no employee, μISV.

It's possible, but here's what I have found:

\- Partner with resellers who take a commission on sales -- then they can deal with all of the customer management.

\- Set realistic goals for uptime, machines go down (it's not if but when), distributed setups are possible and encouraged for larger customers, but they cost more.

p.s. Wanna get a slack channel for solo founders going?

EDIT: I've created a slack group - Email me if you would like an invite!

<comment><AUTHOR> I'd love to get a slack channel for solo founders. Just forewarning I have never used Slack before but I'd be down to learn.

What kind of software do you sell? Is it desktop, mobile, web?

Also, is your price point rather high? I would imagine something like a $120 product may not benefit from a reseller as it is small deal for them

<comment><USER23> If you can use this forum, you can use slack.

</comment></comment></comment><comment><USER24> I'm working on it, and a friend of mine does it successfully.

He builds plugins for the Shopify platform and ended up hiring one developer to do full time onboarding of new clients, support and documentation, but does all product development himself.

I think it's definitely realistic. You gotta just have a mindset where you try and eliminate all bottlenecks and automate as much as possible.

The trick he found for coming up with product ideas was to first do custom development. When enough clients are willing to spend a few thousand for a personal implementation of something, that's when you know you have an opportunity to charge 40$ per month for a SaaS version :)

<comment><USER25> Taking advantage of the momentum of another platform by building a plugin, skin, or extension is a great way to slingshot a project. There's also some risk involved, because that platform usually has the power to cut you off, legally if not technically.

</comment></comment><comment><USER26> Yes, it is absolutely possible. I have been doing this for years focusing on niche SaaS products that are too small for VC funded or big companies to go after. I am currently bringing in $20k/mo from my SaaS stuff (3 different niche products) and additional revenue on top of that with adsense/affiliate stuff.

I ran an advertising agency with employees at one point and grew it to $50k/mo but hated it so stopped and went back to single founder SaaS stuff.

Before the recession hit, I also ran a SaaS product in the Real Estate sector that brought in over $70k/mo at its height. I had a few employees during that time too.

I personally enjoy being a single founder running niche products but it has its downsides. Also, once you reach a certain growth point, it becomes much more difficult to go it alone. At that point, you can either hire employees to help or decide maybe it is best to sell.

<comment><USER27> Have you sold any of your businesses before? If so, how did you seek out businesses to buy yours?

<comment><USER26> I haven't but am considering selling one of the products next year. I plan to go through a Broker.

I had a soft offer in the $3 mil range from a big company for that real estate product I mentioned. They reached out to me. I pretty much blew it off because it was in a growth phase and I felt I could grow it more. 6 months later, the real estate market crashed and that product lost 50% of its revenue within a year. In hindsight, I wish I took that offer a little more serious.

<comment><USER28> Unrelated point, but I would do anything (even put school on hold) just to be able to work with a mentor like you. Being a solo founder for niche Saas products is exactly what I aspire to be, and learning from someone who's been there and done that would be a terrific experience

<comment><USER26> I will reach out to you at the beginning of the new year. Honestly though if you are interested, I would put you mostly on advertising related stuff. Coding is the easy part, advertising and acquiring users is the hard part. Learning how to advertise a product and acquire users for less than what you are spend is one of the most important pieces of running a SaaS.

<comment><USER28> Oh wow, that'd be super amazing, and I look forward to that.

I wholeheartedly agree that advertising and acquiring users are the most important pieces, and also one of the hardest. Finding a niche and the market to go after (who do I approach? what do I say? what sort of problems can I solve that hasnt already been done? etc) has been a stumbling block, not to mention the fact that I'm far from technically fluent to spin up a basic prototype to demo.

As such I kinda put that aspiration on hold and decided to hone my craft in CS / programming in general, so that at least I have a solid, technical base to built off on.

Anyhow, I really appreciate your response and am excited to hearing back from you.

</comment></comment></comment></comment></comment></comment><comment><USER29> You might be interested in [http://www.microconf.com/](http://www.microconf.com/)

I went to the conferences when I was a one man startup, and it was helpful.

<comment><AUTHOR> I've heard many things on Microconf from Mike and Rob on Startups for the Rest of Us. The problem is paying for a ticket as well as airfare to get there. Due to family financial responsibilities my company operates its own accounts and can only spend what it takes in. I'm currently down to a couple hundred dollars and I have monthly expenses that take cuts out of that. Any sort of conference is out of the question.

I am curious, though, what was it about the conference that made it helpful for you?

<comment><USER29> It was a lot of little things. One big takeaway is that they're big on going vertical not horizontal. Find a niche.

There was some useful stuff on landing page optimization.

patio11 gave a talk that year that was great.

I also found it helpful to talk to other people doing the same thing I was. A solo startup can be kind of isolating.

So it isn't anything you _need_ to do. As I mentioned below this, the book "Start Small, Stay Small" has a lot of the practical stuff, if $25 is more in your budget.

</comment></comment></comment><comment><USER30> I recently tried to become my own ISV. I produced the first draft of [https://conciergeapp.uk/](https://conciergeapp.uk/) within 2 weeks after a chat with someone who is in the Facilities Management (FM) section. Initial interest in the market looked good and I had plans to make a modular platform. After some refinement etc, I totally failed to sell it. I tried so hard but it was exhausting. Then I got a regular job, but still.. this does appeal. Wish you luck! The hard part is not the coding.

<comment><USER31> saw the website and got one question: who is your market target?

<comment><USER30> The target market is companies providing facilities management services to residential apartment blocks.

</comment></comment></comment><comment><USER32> Yes it's possible. I've been doing it for nearly four years now running networking infrastructure software which has even stricter requirements than a typical SaaS business.

It's not easy though. Assuming you have product/market fit (i.e. something that sells):

Reliability is paramount. It is everything to you. If your system breaks, it will stop new development, marketing, support responses, sales calls. Because there is only one of you, you can't afford to spend time fighting fires and answering pages. It does not matter if your software is slow or fast or if it is pretty or ugly or if your userbase is growing or not if you are down.

Reliability is paramount. Invest your time into building systems that do not fail when one component or one machine breaks. Where you can, you should leverage primitives and services from cloud providers that provide the kind of failure guarantees you need. Then assume that your cloud providers will eventually fail on you, so design with that in mind. Take as few dependencies on them as you can handle or make sure you can failover between them.

Reliability is paramount. Every change you deploy could break your systems and cause downtime. You need good testing and monitoring. Run continuous end-to- end testing of all customer-facing functionality that pages you when it fails.

Reliability is a feature if your software is critical to your customer's business. Some will notice when your competitors are down and you aren't. For those that don't notice, educate them. Explain to your customers the investments you've made to keep your service up and running. You can sell it as a differentiator.

After that, support is the next time-sink you need to eliminate. Treat every support request as a bug that can be fixed so it doesn't happen again. Make it extraordinarily easy to contact you and then try to optimize so no one ever contacts you. Invest in your UX. Your UX should try to illuminate the inner workings of your software. Many support requests are simply failures of a customer to understand what your software is doing and why. Customers can't debug black boxes, but they are smart and motivated and if you invest in their understanding, many will solve their own problems before contacting you.

Design your error messages. Your error messages are a more important piece of design than any other messaging from your product. Finally, if you can't solve the support bug with UX, invest in your documentation. Documentation is your last resort because most users will not read it or they will only read portions of it. By the time they get to the docs they're already frustrated, so it needs to be fantastic.

good luck!

<comment><USER33> > Make it extraordinarily easy to contact you and then try to optimize so no > one ever contacts you.

> By the time they get to the docs they're already frustrated, so it needs to > be fantastic.

Well said.

</comment></comment><comment><USER34> I made Menutail ([https://www.menutail.com](https://www.menutail.com)) which creates nutrition facts labels for food vendors. Up time is definitely important, but if things go wrong, customers are understanding if you communicate honestly with them on what is going on.

The other thing to be careful of is feature creep to ensure it is valuable for your customer base. If one customer complains that they want something which would be super difficult and applicable to only one edge case, I'd take some pause to evaluate the feedback.

The other thing as ovidiup mentioned, marketing is the absolutely hardest. I would even consider it soul draining if you like coding, but it is super necessary. I would recommend reading this book to help think about your sales channel

[https://www.amazon.com/Impossible-Inevitable-Hyper-Growth- Co...](https://www.amazon.com/Impossible-Inevitable-Hyper-Growth-Companies- Predictable-ebook/dp/B01AXTFMSW)

</comment><comment><USER35> [http://indiehackers.com](http://indiehackers.com) has been making the rounds on HN lately and shows that it's definitely possible. But of course, keep in mind these are the success stories.

</comment><comment><USER36> Yes. I am my boss's only employee, and I only work part-time while studying. Before he hired me, it was just him. We develop software for the real estate industry for property management and trust accounting. We have one major client that we work with directly, and we have a specific version of our software that we only supply to them. We also have a partnership with another company overseas who we license our software to, while they handle client relations and support.

It appears to working out quite well for him, as he is currently on holiday overseas.

</comment><comment><USER37> sure, i do it. Develop a custom system for a company and then charge a monthly use and/or maint. fee. If the original development was tested well you are essentially getting free money every month.

I have a full time job but one client on the side. I built a system for them that I net $1,250 per month on and do 2 hours of work a month at most. Rackspace takes care of almost all host related items for me.

I have a partner who also makes $1,250 from the same contract. In hind sight I could have easily done the whole project without him and be making $2,500 per month.

Been going for almost 3 years now, probably has a shelf life of another 7 years.

If you can get a few customers like this, you are set. The challenge is of course to get more customers, let me know when you solve that issue, I'm still working on it :)

edit: changed gross to net

<comment><USER38> What's your Rackspace hosting cost / month? I realize it would vary for different situations, but just curious if you don't mind sharing.

<comment><USER37> Sure, it's approx $500 per month. We gross $3,500 per month and pay hosting and business insurance as expenses. net is $2,500.

Edit: hosting includes daily backups

</comment></comment></comment><comment><USER39> Do you have a sales channel?

I know a guy who continues to run a one-man software shop for some municipal government functions that are important, but too small for a more general software company.

Key factor for him is that his uncle had been a well-known person, which got him in the door early on.

</comment><comment><USER40> I think it is doable. I write a few desktop apps (text editor) for OS X, Windows, Linux, iPad and I have a few games in the app store with more coming. Some days I pull my hair out from the stress but overall I am happy writing the products.

<comment><AUTHOR> Are you making money on any of those products?

<comment><USER40> The text editor I pulled from being sold a long while back. Now I maintain it and have a new version I am contemplating putting out for sale again.

The games are way better :-)

</comment></comment></comment><comment><USER25> I had such a project that was making about $15k/mo at its peak -- it was me and my wife, barring a couple of spot contributions from contractors. It depended on data from a sole data source, a Fortune 100 company, which eventually cut us off by sending a C&D threatening to sue under the CFAA, Copyright Act, and various other statutes. They claimed we breached the contract entered automatically by using their site, as their Terms of Service states that "no automated or manual method" (i.e., no method at all) can be used to access their content and their footer states that use of the site constitutes agreement (this is called "browsewrap"). The way we accessed data was much lower-impact than the way our clients accessed the data previously and I'm fully convinced that we saved them tens of thousands in maintenance and bandwidth costs.

No other data source is capable of providing the content we needed. We were forced to shut down.

We knew this was a possible eventuality and our ToS explicitly disclaimed responsibility for it. Our site required users to check both a checkbox and click OK on a dialog box that served only to inform that they used the product at their own risk, nothing was guaranteed, and no refunds of any kind would be furnished. When we shut down, many angry users demanded refunds and issued chargebacks, often after months of successful use, despite the clear and unambiguous language which confronted them several times and required their affirmative assent before they were allowed to purchase anything.

Before we were forced to shut down, other people had caught on to the market and started copying us. We had about a year where we were in it by ourselves. Once serious competitors showed up, they ate our lunch by using a sophisticated spam network to promote their offerings, which were sloppily made by offshore contractors and far worse than our offering in every way, technical and aesthetic.

I refused to engage in similar tactics and felt righteous about it, but it sure cost us a lot of money. They somehow brokered deals with the niche forums that had blacklisted us from day one (or just outspammed their moderation capacity), afraid that we may eventually expand into something that would threaten them directly (which I now plan to do, some day). Perhaps we could've prevented the copycats by acquiring software patents.

These competitors pushed the envelope to the point where it became a visible PR issue and the F100 was forced to respond by C&D'ing every site that operated in the sector I launched and instructing their users to never use anything not distributed directly by the company itself again.

Now, about 16 months post-shutdown, I still get emails from business owners who depended on us begging me to turn the service back on, and saying that their business has been seriously hurt by our absence.

Some of the people in this thread evidently picked much better niches than I did.

<comment><USER41> I usually don't do this, but couldn't you have the customers set up some sort of proxy to acquire the data from the F100? So give them a piece of software that they run on their local network to grab the data and configure your SaaS to point to the customer's site to get it.

Perhaps you've considered this and it wouldn't work for some reason or another. But I thought I'd offer some unsolicited advice.

<comment><USER25> I wanted to do this, and in fact thought of doing it before the takedown occurred, but after the takedown, our lawyer advised me that doing so could be construed as conspiracy to violate the CFAA. He thought it could give them incentive to try to field criminal charges (the CFAA defines both criminal and civil penalties, and as one may expect, the F100 is very well-connected and surely could get a federal prosecutor interested), so I didn't pursue it.

As much as I wanted my business to be able to live on, I wanted to stay out of prison more.

The only option would've been to abandon all US assets and essentially go into exile in a state where the law was more friendly and the F100 would have a harder time getting me shut down (and there are very few jurisdictions without a law substantially derived from the CFAA; the wording of the Telecommunications Act in many Commonwealth nations gives _marginally_ more protection). I didn't think that was a very good option for a relatively small business, I wouldn't have been able to afford it at the time anyway, and it would've had meteoric impacts on my family, so I didn't do it.

On top of that, The Pirate Bay and MegaUpload have proven that the long arm of American corporatism knows no borders.

To their credit, however, Sweden did seem to hold out a long time. They had to be threatened with sanctions from the WTO in order to take down TPB. At that point, Sweden ignored their own law and pushed through a sham trial against TPB's proprietors, who went into exile in non-extradition countries, from which they were eventually stopped at border crossings and extradited to serve time in Sweden. Can't hide from Mickey Mouse.

The most ironic part of this is that the world's largest companies regularly violate the same rules with impunity. Google, for example, routinely and flagrantly violates the CFAA and the Copyright Act, going by the standards that are applied to everyone non-Google. However, Google has been sued over this and won, with their use specifically ruled fair, because they're Google -- and that's essentially the reasoning the judges give if you read the decisions, talking about how it's a "transformative use" that has changed the world, etc. etc. Judges have declined to apply the same logic in later rulings ( _Ticketmaster v. RMG_ ), on the basis that the defendant was _not_ Google.

The moral of the story appears to be break rules and get too big to fail _fast_ , and then you can do whatever you want. If you don't big enough fast enough, you will be destroyed by a large company that's afraid of you.

</comment></comment></comment><comment><USER42> Tarsnap is doing just fine, but he's also doing something unique.

</comment><comment><USER43> You CAN do it, but get a partner. You need someone to bat ideas around with. Having at least one other person will allow you to go a lot farther with the quality of your ideas.

<comment><USER44> Nonsense. Ive been flying solo since my teens and dont really want a partner. Some of us work better independently. Im not against a partner if the right person shows uo, but Im not holding my plans until they appear.

</comment></comment><comment><USER45> I'm going to post a contrarian viewpoint that unless your product is self- contained and it can continue on without you if you are hit by a truck or even acqui-hired for top $, I will avoid you.

Too many pay apps and even games with DLC have gone poof in recent years because of the latter situation or because the cost of maintaining the DLC no longer justified itself.

<comment><AUTHOR> What about with desktop software? Once you buy it you are able to use that version and don't have to rely on the vendor sticking around. Also, how do you go about finding such information about a company if a micro ISV doesn't publicly say they are just a solo venture?

<comment><USER46> When I purchase enterprise software I call them up and ask how many people work for them. In UK (and sure it translates) I normally pull their accounts from companies house. If not incorporated I'm suspicious. If they are it will help me gauge size

</comment></comment></comment><comment><USER47> It really depends on the service (if it solves a real problem) and on the niche (if market is rich and people want to pay good money for your solution); as for other ways related: public media content is done and dusted and facilitator gigs are often not worth the hassle.

</comment><comment><USER48> Pretty much viable. I've experimented with [https://worktheme.com](https://worktheme.com). What I realized is, small increments of work over a long time adds up to really surprising results.

</comment><comment><USER49> Yes absolutely, at least initially. But expect weekends/nights/vacations to be consumed.

Eventually, either due to growth or a desire to have free time again, you'll probably want to bring aboard other persons.

</comment><comment><USER50> Yes.

</comment><comment><USER51> Yes. I know some. You got to pick your battles carefully and really produce though...

</comment><comment><USER52> More than ever

</comment><comment><USER53> Balsamiq Mockups is a good example that microISVs are still viable. At least, Peldi (the founder and sole dev initially) started off solo some years ago, was solo for a while, and became successful while still solo. Then got some employees over time due to more growth.

[http://balsamiq.com](http://balsamiq.com)

Source: I read about Balsamiq Mockups soon after it was created, used it in some commercial projects as a consultant/freelancer, corresponded some with Peldi, and also got a free copy of Mockups early on, for having released an open source product. He had a scheme of giving a free copy to such people. May still have it.

Edit/update:

IIRC, he initially had the idea of doing Mockups as a web app plugin (for JIRA, maybe), and did it, but a lot of people asked for a desktop app, so he did that too, and I remember reading that at least in the early years (maybe now too), the desktop app sold much more. I used the desktop app in my work I mentioned.

<comment><USER53> Another good example of a successful microISV (I just remembered) is Andy Brice (in the UK), the creator of Perfect Table Plan, a wedding seating planning software. He has been an ISV with that as his desktop app product for over 10 years, IIRC.

First got to know of him via his blog:

[http://successfulsoftware.net](http://successfulsoftware.net)

and have corresponded with him too on a few occasions.

He has many interesting / useful posts about the ISV business on his blog - <USER2> many aspects - from technical (he uses C++ and Qt) to commercial, though more of the latter, IIRC. I've read many, and found them interesting. Just got one today in my email, in fact. It's about how one-day sales helped him boost his sales some. (He tries various marketing / sales experiments now and then.) Another interesting thing is that he reviews or interviews other microISVs and their products sometimes - those posts are interesting too. There was one about a file compare tool which was doing quite well - Beyond Compare.

He also started another desktop product, HyperPlan, much after the first, and I read that it too is doing okay.

</comment></comment><comment><USER54> I do. As advised by others comments, I sell a plugin on a platform that takes 20-30%. It's great because they handle the invoicing to big companies, which removes the hassle of being a referenced provider.

I'm ok on the sysadmin side (backups, Ansible, etc) and uptime. I'm subpaar on the support side, because I can't develop features fast enough and I have a problems prioritizing things that my various customers need and, at the same time, I panic at the idea of telling them that "I don't know" whether I'll deliver their tiny feature in 1 week or in 8 months. Anyway, it's all problems you can solve by being more efficient or professional, just keep in mind that support/bugfixing will creep up as you add features, up to 80% of your time, at which point you'll either have enough money to hire, or notice that the business model doesn't bring enough money.

There is definitely room for us, micro ISV: Do it as long as you like it / enjoy the lifestyle.

Also, "don't talk to corp dev" (cf Paul Graham's essay) unless you want to sell, in which case use an acquisition broker marketplace (cf patio11's essays).

<comment><USER55> You might want to try something like Pivotal Tracker if you aren't already. Estimating each "task" and then prioritizing them seems to help me see how long it will actually be before I will get to a specific feature. Pivotal is pretty good at estimating your future tasks based on your past tasks.

<comment><USER54> It's not about estimates, it's that my output isn't enough to be ahead of my customers' requests, so that they wouldn't have to ask for them, or I wouldn't have to provide a workaround until I develop the specific feature.

<comment><USER56> I used to have the same problem and have since become an expert in saying "No sorry we can't do that" or "we can but it costs this much".

Your clients will eventually thank you because you'll sustain the service longer if it's worthwhile for you.

</comment></comment></comment></comment><comment><USER57> Yes

<comment><USER14> K</comment></comment>


A Moby-based container engine for IoT - <AUTHOR> https://www.balena.io <comment><USER2> This looks like a great project. I have a few questions in case the maintainers read this.

\- Do you plan to stay up-to-date with new Moby releases, or is it a one-time hard fork?

\- Do you plan on contributing some of the IoT optimizations back into mainline Moby over time?

\- If you have contributed to Moby in the past, what's your experience of contributing, is the community welcoming?

\- What's the planned differenciation between Balena and Resin.io?

</comment><comment><USER3> For some extra context (differences, features, comparison), here are the slides introducing Balena at the Moby Summit last year:

[https://www.slideshare.net/resin_io/balena-a-mobybased- conta...](https://www.slideshare.net/resin_io/balena-a-mobybased-container- engine-for-iot)

(too bad that the talk wasn't recorded by the organizers, as far as I know)

</comment><comment><USER4> but why, tho?

What sorts of devices would benefit from a system like this? Can someone give me sone use cases where being able to run containers on embedded devices would be useful? The tech seems pretty cool, but I am just having a hard time wrapping my head around it as someone who's experience with embedded stops at hacking on raspi/arduino/esp* devices

<comment><USER5> hey there -- resin.io founder here.

We built balena after running docker for millions of hours on resinOS devices. Turns out, containers are not just a good, but probably the best way to manage software on embedded linux devices. The whole "edge computing" wave that's started moving now is based on the idea of deploying containerised workloads to these devices. What we found though, is that Docker tends to have several subtle biases towards cloud usage that become apparent in the embedded context. So we made Balena to embed our improvements into Docker.

I can talk about this stuff for hours, but suffice to say we have customers doing building automation, smart retail, digital signage, industrial automation, automotive, etc. My current favourite though is the guys that put devices on the back of sea turtles in the galapagos. Check this footage out: [https://www.youtube.com/watch?v=JfkfLsgEN9Q](https://www.youtube.com/watch?v=JfkfLsgEN9Q)

Edited to add: On the hardware question, resinOS works on many many device types including niche industrial boards and well-known maker SBCs. We've made it relatively easy to port to new devices so we can keep expanding our supported types of devices. In the meantime, we're working on our own "industrial" raspberry pi variant, which, based on our experience so far, should be good enough for 60-80% of serious use cases. [https://resin.io/blog/introducing-project-fin-a-board-for- fl...](https://resin.io/blog/introducing-project-fin-a-board-for-fleet- owners/)

<comment><USER6> Can confirm, resin.io is brilliant. The new multicontainer functionality looks like a great improvement!

Source: have photographed fish with resin/docker.

</comment></comment></comment><comment><USER7> Looks like a great project! What is stopping Docker from using binary diffing in general? It seems it would be a big win for them, I imagine their AWS bandwidth bill is absolutely gigantic.

</comment><comment><USER8> curl www.foo.bar | sh

Yeah, right.

<comment><USER9> why not though? how is 'git clone a huge repo and run an obfuscated makefile' safer?

<comment><USER10> I do genuinely wonder if all the folks on the "let's make fun of curl | sh" train also steadfastly refuse to run ./configure on tarballs from SourceForge, and instead spend the time to audit every custom M4 macro in the project along with every Makefile.am (lest either of them shell out to something untoward) and run autoreconf themselves.

<comment><USER11> Why stop there? Most projects probably don't sign every commit, and even if they do, you'd still want to code review just to make sure mistakes or planted routines didn't make it in. I'm assuming, of course, that any code you compile, you'd eventually want to /run/ somewhere. And if you're going to sandbox it or use permissions to restrict it, well, you could always do the same with the curl command. ;-)

</comment></comment></comment></comment><comment><USER12> Hmm, Moby is quite avant-garde, or at least was back in the day... But why would anyone want to build IoT products on top of an aging DJ?

(... I'll show myself out.)</comment>